Description

Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:53.870Z",
  "pubdate": "2026-08-25T21:17:53.870Z",
  "executiveSummary": "A medium-severity security vulnerability exists within Google Chrome prior to version 152.0.7977.65, specifically involving incorrect authorization handling within the Document Object Model (DOM).\nThe flaw enables a remote attacker to bypass intended security boundaries to access sensitive information residing within the browser's memory or process context.\nThe vulnerability manifests when a user navigates to a specifically crafted HTML page designed to exploit authorization logic errors during DOM manipulation.\nSuccessful exploitation allows an unauthorized party to exfiltrate information that should be protected by the browser's same-origin policy or internal access controls.\nGiven that this is a client-side vulnerability, the attack vector is network-based, requiring only that the victim visits a malicious site.\nThis vulnerability highlights a critical failure in the browser's enforcement of security constraints on DOM interactions, posing a risk of information disclosure regarding user data or browser state.",
  "technicalDetails": "The vulnerability originates from an incorrect authorization check within the Document Object Model (DOM) implementation of Google Chrome. In a secure implementation, the DOM ensures that access to properties, methods, or sensitive browser interfaces is strictly gated by the same-origin policy (SOP) and internal capability checks. In this instance, the authorization logic failed to correctly validate the security context of the requester when performing certain DOM operations.\nThe root cause lies in a failure to verify the provenance or the authorization state of scripts interacting with protected DOM elements. When a crafted HTML page is loaded, it can invoke specific sequences of DOM interactions that the browser incorrectly assumes are permitted, effectively bypassing the security controls designed to prevent cross-site information access.\nExploitation involves a multi-step process. First, the attacker hosts a malicious HTML page containing JavaScript designed to trigger the flawed authorization logic. Upon navigation, the victim's browser executes the script, which interacts with the DOM in a way that exploits the authorization gap. Because the browser fails to apply the necessary access checks, the script gains unauthorized read access to information that is otherwise restricted.\nThe attack is remote and does not require pre-existing authentication or elevated privileges on the victim's host; it relies entirely on the browser's failure to enforce its own internal security logic. The impact of this exploit is unauthorized data retrieval, potentially allowing attackers to scrape sensitive information that the browser is managing, such as cached session tokens, user-specific data, or internal browser identifiers.\nThe vulnerable component is within the Chromium rendering engine's DOM handling subsystem. Since this implementation flaw is inherent to the browser architecture, it affects all versions of Google Chrome prior to 152.0.7977.65. The post-exploitation impact is primarily limited to information disclosure, as the flaw does not inherently provide code execution; however, the stolen information could be leveraged to facilitate more complex, downstream attacks, such as session hijacking or cross-site request forgery (CSRF) if sensitive tokens are successfully exfiltrated."
}